By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 70 of 86

• CVE-2026-36726MEDIUM 5.3

  Bookcars v8.3 contains a vulnerability that allows attackers to delete files from a server without authentication. The flaw exists in an API endpoint designed to remove temporary license files, but it doesn't properly validate file paths. An attacker can exploit this by injecting directory traversal sequences (like '../') into the request to delete files outside the intended temporary directory, potentially removing critical application or system files.

• CVE-2026-38978MEDIUM 5.3

  Transmission, a popular BitTorrent application, contains a clickjacking vulnerability affecting versions up to and including 4.1.1. The flaw allows an attacker to trick users into performing unintended actions through the application's web interface or RPC (remote procedure call) endpoints by overlaying malicious content on top of legitimate interface elements. This requires user interaction but does not require the attacker to be authenticated or have any special privileges to exploit.

• CVE-2026-39899MEDIUM 5.3

  Cacti, a widely-used open source monitoring framework, contains a path traversal vulnerability in its package import functionality. An attacker can exploit a filename parameter in package_import.php to access files outside the intended directory, potentially reading sensitive configuration files or other protected data. The vulnerability requires no authentication and can be triggered remotely, but the confidentiality impact is limited. Cacti versions 1.2.30 and earlier are affected; upgrading to 1.2.31 or later resolves the issue.

• CVE-2026-40012MEDIUM 5.3

  A caching vulnerability in DNS implementations supporting EDNS Client Subnet (ECS) allows improperly scoped DNS responses to persist in the packet cache. When ECS is enabled, certain DNS answers that should remain client-specific are being stored globally, potentially exposing query information across different network segments. This is a moderate confidentiality concern affecting only systems with ECS explicitly configured.

• CVE-2026-40209MEDIUM 5.3

  CVE-2026-40209 is a denial-of-service vulnerability where specially crafted IXFR (Incremental Zone Transfer) queries can cause outgoing TCP connections to backend systems to hang indefinitely, persisting only until a network timeout triggers a release. This resource exhaustion can degrade or disable services if the affected system has finite connection limits or runs low on file descriptors.

• CVE-2026-40211MEDIUM 5.3

  CVE-2026-40211 is a denial-of-service vulnerability affecting DNS over HTTP/3 (DoH3) implementations. An attacker can craft malicious DoH3 queries that trigger an exception in the server, causing a buffer to remain in memory longer than intended. While the buffer is eventually freed when the QUIC connection closes, an attacker with the ability to open many concurrent DoH3 streams could exhaust server memory and force a denial of service. This is a network-accessible vulnerability requiring no authentication or user interaction.

• CVE-2026-40898MEDIUM 5.3

  quic-go, a Go-based QUIC protocol library, contains a denial-of-service flaw in its HTTP/3 implementation that allows remote attackers to exhaust server and client memory by sending malicious HTTP trailer fields. The vulnerability stems from inadequate validation of decoded trailer sizes—the library checks the compressed frame size but fails to enforce limits on the decompressed result. An attacker can craft QPACK-encoded headers with numerous unique field names or oversized values in the trailer section, forcing unbounded memory allocation and potentially crashing affected services.

• CVE-2026-40997MEDIUM 5.3

  Spring Web Services has a flaw where integration with Spring Security can leak information about user account status to unauthenticated SOAP clients. When an attacker attempts to log in via a SOAP endpoint, the system may reveal whether a username exists, is locked, or is disabled—rather than returning a generic "authentication failed" message. This information disclosure helps attackers enumerate valid accounts and understand their lifecycle state without needing valid credentials.

• CVE-2026-41001MEDIUM 5.3

  Spring Boot applications using embedded Artemis message brokers face a local privilege-escalation risk when no explicit data directory is configured. The affected versions default to a predictable, fixed path that an attacker with local system access can exploit before the application starts—either by pre-creating the directory or installing a symlink. This allows the attacker to read, modify, or disrupt the message broker's data, potentially compromising application integrity and confidentiality.

• CVE-2026-41150MEDIUM 5.3

  Mermaid, a popular JavaScript library for creating diagrams from text, contains a denial-of-service vulnerability in versions before 10.9.6 and 11.15.0. The flaw occurs when rendering Gantt charts that use the excludes attribute to block out all dates. An attacker can craft a malicious diagram that, when processed and rendered, causes the application to hang or consume excessive resources, disrupting service availability. The vulnerability only manifests during actual diagram rendering; simply parsing the diagram syntax does not trigger the issue unless the ganttDb.getTasks() function is subsequently called.

• CVE-2026-41159MEDIUM 5.3

  Mermaid, a popular JavaScript library for creating diagrams from text, contains a CSS injection vulnerability in its configuration options. Attackers can inject malicious CSS through the fontFamily, themeCSS, and altFontFamily settings that breaks out of the intended diagram sandbox and affects the entire web page. This could enable page defacement or extraction of sensitive information through CSS selectors. The vulnerability affects versions before 10.9.6 and 11.15.0, and has been patched in those releases.

• CVE-2026-41178MEDIUM 5.3

  OpenTelemetry-Go versions 1.41.0 and 1.43.0 contain a denial-of-service vulnerability in their baggage header parsing logic. The removal of size validation allows attackers to send oversized or malformed baggage headers that cause the application to process arbitrarily large inputs, log excessive errors, and potentially exhaust system resources. This is a network-accessible vulnerability requiring no authentication, making it exploitable by any remote actor.

• CVE-2026-41207MEDIUM 5.3

  A vulnerability exists in Netty's binary HTTP parser (netty-incubator-codec-ohttp) where cryptographic key generation can fail silently and default to all-zero keys without raising an error. This occurs in the HKDF_expand and EVP_HPKE_CTX_export functions, which are supposed to generate random key material for encrypting HTTP responses. Instead of signaling failure, these functions return zero-filled byte arrays that are indistinguishable from legitimate keys. An attacker who understands this behavior could predict the encryption keys and decrypt sensitive response data, compromising the confidentiality of encrypted messages. The issue was resolved in version 0.0.21.Final.

• CVE-2026-41730MEDIUM 5.3

  Spring Data REST, a popular framework for building REST APIs on top of Spring Data repositories, has a flaw where detailed error messages—including information from the underlying database layer—are exposed directly to API clients. When an exception occurs during request processing, the full chain of causes is serialized into HTTP error responses. This means a remote attacker can trigger exceptions and receive detailed stack traces and system internals that should remain hidden. The vulnerability affects multiple versions across the 3.7, 4.3, 4.4, 4.5, and 5.0 release lines.

• CVE-2026-41837MEDIUM 5.3

  Spring Data REST's filtering feature bypasses Jackson customizations when processing user-supplied filter parameters, potentially allowing attackers to access sensitive object properties that should be restricted. An unauthenticated attacker can craft malicious filter requests to extract unauthorized information from the application's data layer without modifying or disrupting service.

• CVE-2026-41851MEDIUM 5.3

  Spring Framework contains a vulnerability in how it handles Spring Expression Language (SpEL) expressions when applications allow user input to be evaluated as SpEL code. An attacker can craft specially designed expressions that cause the framework's internal cache to grow without bounds, consuming memory until the application becomes unresponsive or crashes. This is a denial-of-service (DoS) condition that requires no authentication and can be triggered remotely.

• CVE-2026-41853MEDIUM 5.3

  Spring Framework versions 5.3.0 through 7.0.7 contain a vulnerability allowing attackers to perform multipart request smuggling attacks. This vulnerability lets unauthenticated remote attackers craft malformed multipart HTTP requests that can be interpreted differently by intermediate proxies or load balancers versus the Spring application itself, potentially leading to request confusion and unauthorized actions. No user interaction is required, and the vulnerability affects both Spring MVC and WebFlux application handlers.

• CVE-2026-41981MEDIUM 5.3

  CVE-2026-41981 is a medium-severity vulnerability affecting the IPC (Inter-Process Communication) module that allows an attacker with local access to write data outside the intended memory boundaries. This out-of-bounds write can corrupt system memory and lead to service disruptions or unexpected behavior. The vulnerability requires local access and user-level privileges to exploit, reducing its immediate threat surface but still warranting timely remediation in multi-user or containerized environments.

• CVE-2026-42389MEDIUM 5.3

  CVE-2026-42389 is a medium-severity vulnerability affecting DNS resolver software in the 5.4.x branch. The issue stems from insufficient validation of responses received from authoritative DNS servers, which could allow an attacker to inject or manipulate DNS answers. The vendor has addressed this by implementing additional hardening checks. While the vulnerability does not currently appear on CISA's Known Exploited Vulnerabilities (KEV) catalog, organizations running vulnerable versions should treat it as a standard update priority.

• CVE-2026-42390MEDIUM 5.3

  A validation bypass has been identified in ZONEMD (Zone Message Digest) verification logic. Under specific configurations, DNS zones with invalid signatures can incorrectly pass validation checks, potentially allowing corrupted or maliciously modified zone data to be accepted as legitimate. This affects systems using ZoneToCache with ZONEMD validation enabled.

• CVE-2026-42489MEDIUM 5.3

  CVE-2026-42489 is a fairness issue in Xen's domain control lock mechanism. When the control domain or related privilege holders use domctl operations to create and manage guest domains, a system-wide lock is employed to serialize certain operations. However, this lock does not implement fairness guarantees, meaning some requesters can be starved indefinitely while others gain repeated access. An attacker with high privileges who can issue domctl operations could exploit this to cause denial of service by monopolizing the lock and preventing legitimate domain management tasks from completing.

• CVE-2026-42500MEDIUM 5.3

  CVE-2026-42500 is a denial-of-service vulnerability triggered when software attempts to decode a specially crafted BMP image file with palette colors that reference invalid color table entries. The flaw causes the application to crash rather than handle the malformed data gracefully. An attacker can exploit this by distributing or hosting a malicious BMP file that, when opened or processed, crashes the affected application.

• CVE-2026-42505MEDIUM 5.3

  CVE-2026-42505 is a privacy disclosure flaw in TLS implementations that support Encrypted Client Hello (ECH). When a client initiates an encrypted handshake using ECH, the pre-shared key (PSK) identifier—which can uniquely identify the client—remains visible in the unencrypted portions of the ClientHello message. This allows a passive network observer (someone monitoring traffic without modifying it) to correlate and de-anonymize connections, undermining the privacy guarantees that ECH was designed to provide. The vulnerability affects Go's TLS library and has a CVSS score of 5.3 (Medium severity), reflecting confidentiality impact without allowing code execution or service disruption.

• CVE-2026-42507MEDIUM 5.3

  CVE-2026-42507 is a moderate security issue affecting Go's net/textproto package where error messages can inadvertently expose or reflect user-supplied input. An attacker could craft malicious input that, when an error occurs, gets embedded into the error message itself. If those messages are logged, displayed to users, or forwarded to monitoring systems, the attacker's injected content appears as legitimate system output. This creates an integrity risk by allowing misleading information to be introduced into logs and alerts.

• CVE-2026-42769MEDIUM 5.3

  A defect in OpenSSL's Certificate Management Protocol (CMP) implementation allows an attacker with valid Registration Authority credentials to trick CMP clients into accepting a forged root CA certificate as legitimate. The flaw stems from a typo in certificate chain validation code that disabled critical signature verification checks during root CA key rollover operations. While the vulnerability requires the attacker to already possess RA-level credentials, successful exploitation would grant them root CA authority over affected clients—a significant privilege escalation. The FIPS module implementation of OpenSSL is not affected.

• CVE-2026-42914MEDIUM 5.3

  A vulnerability in Windows Kerberos allows an authenticated attacker to cause a denial-of-service condition by reading memory outside the intended bounds. The attacker must already have network access and valid credentials to exploit this issue, which means it poses a risk primarily in environments where internal adversaries or compromised accounts could launch attacks. The impact is limited to service disruption rather than data theft or system compromise.

• CVE-2026-42932MEDIUM 5.3

  Naxclow devices use predictable device identifiers that are generated using fixed manufacturing prefixes and simple sequential counters. This design flaw allows an attacker to easily predict or enumerate which devices exist on a network without authentication. Additionally, the platform exposes a publicly accessible endpoint that reveals the highest device identifier currently in use, making it trivial to determine the size and composition of an active Naxclow fleet.

• CVE-2026-4360MEDIUM 5.3

  CVE-2026-4360 is a vulnerability in Python's tarfile extraction mechanism where the security filter parameter is bypassed when extracting hardlinks from tar archives. When a developer uses the `filter='data'` parameter—intended to restrict file ownership changes—the filter is not applied to hardlinks, allowing an attacker to craft a malicious tar file that assigns unexpected user and group identifiers (uid/gid) to extracted files. This could lead to privilege escalation or file ownership manipulation on systems processing untrusted archives.

• CVE-2026-43704MEDIUM 5.3

  A memory management flaw in Apple's Safari browser and related operating systems could allow a malicious web extension to crash the browser or application unexpectedly. The vulnerability (CVE-2026-43704) stems from improper handling of memory after it has been freed, a class of bug that can be exploited by attackers who craft malicious extensions. Apple has patched the issue across Safari, iOS, iPadOS, macOS, tvOS, visionOS, and watchOS.

• CVE-2026-44188MEDIUM 5.3

  Ansible Lightspeed contains a session management flaw that allows attackers to hijack user access tokens. If a threat actor obtains a valid OAuth access token—either through theft or interception before a user logs out—they can reuse it to authenticate and access the Ansible instance long after the legitimate user believes they have disconnected. The core problem is that Lightspeed doesn't actively revoke tokens on the backend when sessions end; tokens remain valid until they naturally expire on their own schedule. This grants unauthorized read access to sensitive infrastructure-as-code assets like inventories, playbooks, and configuration details.

• CVE-2026-44332MEDIUM 5.3

  Fiber, a popular Go web framework modeled after Express.js, contains a timing-based username enumeration vulnerability in its BasicAuth middleware. When authentication is attempted, the framework's default authorizer function checks whether a username exists before validating the password. An attacker can exploit this by observing subtle differences in response times—valid usernames return faster than invalid ones because the password comparison step is skipped entirely for non-existent users. This allows an attacker to reliably discover which usernames are active on a system without needing valid credentials. The flaw affects all versions prior to 3.3.0.

• CVE-2026-44342MEDIUM 5.3

  New API, an LLM gateway and AI asset management platform, contains a cross-site request forgery (CSRF) vulnerability in its account binding functionality. Versions before 0.12.0-alpha.1 use GET requests for sensitive operations that should require POST, allowing attackers to trick logged-in users into binding attacker-controlled email addresses or OAuth identities to their accounts without explicit consent. The vulnerability requires an attacker to craft a malicious link or webpage and relies on a user clicking it while authenticated to New API, but the impact—account takeover through OAuth binding—is significant enough to warrant immediate attention.

• CVE-2026-44505MEDIUM 5.3

  Nimiq's network-libp2p component has a flaw in how it handles responses from peer nodes during Distributed Hash Table (DHT) lookups. When a peer returns a record that fails verification, the code fails to properly clean up internal tracking structures and notify waiting callers. This leaves caller processes hanging indefinitely, unable to complete their operations. The issue affects Nimiq versions prior to 1.4.0 and is resolved in that release.

• CVE-2026-44518MEDIUM 5.3

  liboqs, an open-source cryptographic library implementing post-quantum algorithms, contains an out-of-bounds read flaw in its XMSS and XMSS^MT signature verification routines. When a verification function receives a signature buffer shorter than expected, the code reads beyond the buffer boundary without length validation. While the out-of-bounds bytes are only used internally for hashing and cannot leak sensitive data, the read can crash the verifying process if it accesses unmapped memory, creating a denial-of-service risk. The issue is resolved in version 0.16.0.

• CVE-2026-44545MEDIUM 5.3

  Daphne, a popular ASGI application server for Django, contains a configuration flaw that leaves WebSocket connections vulnerable to denial-of-service attacks. Versions before 4.2.2 fail to enforce limits on WebSocket message and frame sizes, allowing unauthenticated attackers to send extremely large messages that consume server memory until the application becomes unresponsive. This occurs because Daphne does not pass payload size constraints to the underlying Autobahn WebSocket library, which defaults to unlimited sizes.

• CVE-2026-44646MEDIUM 5.3

  LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, has a flaw in how it handles security settings when rendering partial templates using the {% render %} tag. When a developer configures LiquidJS with a permissive default setting but then tries to tighten security for specific untrusted template content, that tightened security is silently ignored for any partials rendered within it. This allows an attacker to access properties from the JavaScript prototype chain—essentially reading unintended internal object data—even when the developer believed they had locked down access.

• CVE-2026-44967MEDIUM 5.3

  OpenTelemetry-cpp, the C++ library for exporting observability data (traces, metrics, logs), has a flaw in how it handles HTTP responses from collector endpoints. Before version 1.27.0, the library reads entire HTTP responses into memory without any limit. An attacker who controls the collector endpoint—or intercepts the connection—can send arbitrarily large responses to exhaust the application's memory, causing it to crash or become unresponsive. This is a denial-of-service risk for applications instrumented with vulnerable versions of OpenTelemetry-cpp.

• CVE-2026-45031MEDIUM 5.3

  ImageMagick, a widely-used open-source image processing tool, contains a vulnerability in its PSD (Photoshop) file decoder that allows an attacker to circumvent resource limits designed to prevent denial-of-service attacks. By crafting a malicious PSD file, an attacker can cause excessive resource consumption during image decoding, potentially disrupting services that rely on ImageMagick to process untrusted image uploads. The vulnerability affects versions prior to 6.9.13-47 and 7.1.2-22, and patches are now available.

• CVE-2026-45045MEDIUM 5.3

  A flaw in the Fiber web framework allows attackers to inject a false X-Real-IP header that bypasses the proxy's intended override mechanism. When Fiber's BalancerForward proxy helper processes requests, it appends attacker-supplied IP values instead of replacing them, causing upstream systems to log or enforce policies based on the attacker's spoofed IP rather than the true client IP. This undermines logging accuracy, rate-limiting enforcement, and IP-based access controls downstream.

• CVE-2026-45085MEDIUM 5.3

  Discourse, a popular open-source discussion platform, contains four separate authorization and information disclosure flaws in its chat plugin (and one overlapping with the calendar plugin). The vulnerabilities allow read-only category members to create chat threads they shouldn't, permit users to recover deleted messages even after losing channel access, expose unrelated private messages to moderators reviewing flagged content, and leak chat channel details and message content to unauthorized viewers including anonymous users. These gaps bypass intended access controls and leak sensitive conversation data. The issues affect Discourse instances with the chat plugin enabled; the calendar-related exposure additionally requires the discourse-calendar plugin.

• CVE-2026-45289MEDIUM 5.3

  CloudburstMC Protocol, a library used in Minecraft Bedrock Edition servers, contained incomplete validation logic for a specific type of authentication token. This gap allowed attackers to potentially forge or manipulate authentication credentials without proper verification, compromising the integrity of server access control. The vulnerability affects publicly exposed servers running vulnerable versions of the library prior to the patched release.

• CVE-2026-45292MEDIUM 5.3

  OpenTelemetry Java is a popular library used by applications to record performance and diagnostic data. This vulnerability affects how it processes baggage—metadata that flows across service calls in distributed systems. An attacker can send oversized baggage that causes affected services to consume excessive memory and CPU, leading to denial of service. Because baggage is automatically forwarded to downstream services, the impact spreads beyond the initial target, potentially degrading performance across your entire microservices architecture.

• CVE-2026-45294MEDIUM 5.3

  FreeScout, a Laravel-based open-source help desk platform, leaks information about whether an email address is registered as a helpdesk agent account. An attacker can repeatedly submit email addresses to the password reset feature and observe different visual responses that reveal which accounts exist—a technique called user enumeration. This flaw affects all versions before 1.8.219 and requires no authentication or user interaction to exploit.

• CVE-2026-45352MEDIUM 5.3

  cpp-httplib, a popular C++ HTTP library, contains a flaw in how it processes chunked HTTP transfers. When a malicious client sends a specially crafted HTTP request with a negative chunk size (like '-2'), the library's parsing logic mishandles it. Instead of rejecting the invalid value, it converts it to an extremely large number due to how C's strtoul function treats negative numbers. This causes the server to attempt allocating massive amounts of memory and reading far more data than expected, ultimately crashing the process. Applications using cpp-httplib versions before 0.43.4 are vulnerable.

• CVE-2026-45358MEDIUM 5.3

  ImageMagick, widely used image processing software, contains an off-by-one error in its meta encoder that allows reading a single byte of memory beyond intended bounds. An unauthenticated attacker can trigger this vulnerability over the network without user interaction, potentially exposing sensitive information from the application's memory. The vulnerability affects ImageMagick versions prior to 6.9.13-47 (legacy branch) and 7.1.2-22 (current branch).

• CVE-2026-45409MEDIUM 5.3

  The Python IDNA library, which handles internationalized domain names, has a resource-exhaustion vulnerability that allows attackers to cause denial-of-service by sending specially crafted, extremely long domain names to the idna.encode() function. The vulnerability stems from the library processing certain Unicode patterns through validation logic before rejecting them as too long—a process that can consume significant CPU and memory for large inputs. This is a regression: the same issue was supposedly patched in 2024 (CVE-2024-3651), but the fix was incomplete and only addressed some code paths. Version 3.15 extends the complete fix to all relevant functions. Under normal circumstances, domain names are limited to 253 characters, so legitimate applications are unaffected. The risk exists primarily when applications pass unvalidated, arbitrarily large input directly to the library.

• CVE-2026-45410MEDIUM 5.3

  TREK, a collaborative travel planning application, contains a user enumeration vulnerability in its login process that allows attackers to determine whether specific email addresses have accounts in the system. The flaw stems from a timing discrepancy: when a user submits a login attempt with a valid email address, the backend takes approximately 370 milliseconds to complete its password check before denying access. For non-existent accounts, the system responds in roughly 10 milliseconds. This 14-fold difference in response time leaks account existence information without any change in HTTP status codes or error messages, making it detectable through simple response timing analysis. The issue has been resolved in version 3.0.18.

• CVE-2026-45543MEDIUM 5.3

  A flaw in Nextcloud Forms allows collaborators who have been removed from a form to retain unauthorized read access to uploaded respondent files. This affects forms running Nextcloud versions 4.3.0 through 5.2.6. If a user previously had access to view form results, removing them as a collaborator does not fully revoke their ability to read uploaded files associated with that form. The vulnerability is limited to files uploaded within forms where the removed user previously held results-viewing permissions.

• CVE-2026-45554MEDIUM 5.3

  NiceGUI, a Python UI framework built on FastAPI, contains a vulnerability in how it handles requests for static assets. Two specific routes can be manipulated to point to directories instead of files. When this happens, the framework throws an error that gets logged with full technical details—and these routes don't require authentication. An attacker can repeatedly trigger these errors to flood the server logs, potentially filling up disk space or overwhelming logging infrastructure. This affects NiceGUI versions before 3.12.0 and has been fixed in version 3.12.0 and later.

• CVE-2026-45620MEDIUM 5.3

  CVE-2026-45620 is a user enumeration vulnerability in WWBN AVideo version 29.0 and earlier. The `objects/mention.json.php` endpoint lacks proper authentication controls and allows attackers to discover valid usernames on the platform without logging in. An attacker can craft requests to the endpoint and enumerate users by checking responses, potentially gathering intelligence for follow-up attacks like credential stuffing or targeted social engineering.

• CVE-2026-45655MEDIUM 5.3

  Windows BitLocker, Microsoft's full-disk encryption feature, contains a flaw that allows an attacker with physical access to a device to bypass its protection and access encrypted data. The vulnerability affects multiple versions of Windows 10, Windows 11, and Windows Server. While an attacker must have hands-on access to the machine, the risk is significant because BitLocker is often the last defense against data theft when a device is lost, stolen, or accessed by an insider. This is not a remote attack; it requires physical presence.

• CVE-2026-45664MEDIUM 5.3

  ImageMagick, a widely-used tool for image processing and manipulation, has a vulnerability in its MNG (Multiple-Image Network Graphics) file handler that allows an attacker to bypass resource limits. By crafting a malicious MNG file with more images than the system's policy allows, an attacker can trigger excessive resource consumption—potentially causing performance degradation or denial of service. The vulnerability affects ImageMagick versions before 6.9.13-47 and 7.1.2-22, and has been resolved in those patch versions.

• CVE-2026-45780MEDIUM 5.3

  Discourse, an open-source discussion platform, has a flaw in how it handles event information that could unintentionally reveal sensitive details about private events. Specifically, the names of invited groups, sample invitee lists, and attendance statistics were being exposed to anyone who could view a topic—even if they shouldn't have access to the private event's invitee information. This is a permissions boundary issue: unauthorized users gain visibility into data they're not entitled to see. The vendor has patched this across multiple supported versions.

• CVE-2026-46337MEDIUM 5.3

  WWBN AVideo, an open-source video platform, contains a path-traversal vulnerability in version 29.0 and earlier that allows anyone on the internet to download image files from the server without logging in. An attacker can bypass the application's permission controls to access private user profile photos, admin-uploaded thumbnails, encrypted-video poster frames, and files in neighboring directories. The vulnerability exists because the affected endpoint does not validate or restrict file paths before serving images.

• CVE-2026-46344MEDIUM 5.3

  liboqs, an open-source cryptographic library implementing post-quantum algorithms, contains a flaw in its XMSS and XMSS^MT signature verification code. When verifying a signature, the code re-parses algorithm metadata from the public key and uses that metadata to determine how many bytes to read from the signature buffer. An attacker can craft a mismatched public key whose metadata claims a larger signature format than the buffer actually contains, causing an out-of-bounds read. While the read data is only used internally for hashing and cannot be stolen, it can crash the verification process if it reaches unmapped memory.

• CVE-2026-46349MEDIUM 5.3

  Mastodon versions before 4.5.10, 4.4.17, and 4.3.23 contain a flaw in how they validate digitally signed messages (Linked-Data Signatures) from other servers. An attacker can manipulate the structure of a valid signed message without breaking the signature, causing Mastodon to process it in unintended ways. This could allow spoofing—making a message appear to come from someone it didn't actually come from—but the immediate impact is limited to message manipulation rather than data theft or system shutdown.

• CVE-2026-46453MEDIUM 5.3

  Apache Camel's Elasticsearch REST client component has a critical configuration oversight that allows unauthenticated attackers to hijack Elasticsearch operations when the component is exposed via HTTP. The vulnerability stems from improperly named HTTP headers that bypass Camel's standard security filtering. An attacker can inject headers to read all documents, delete data, or extract sensitive information without any credentials. This affects multiple versions of Apache Camel and requires immediate patching or defensive workarounds.

• CVE-2026-46543MEDIUM 5.3

  A flaw in Nimiq's full node implementation allows any remote attacker to crash a node by sending a specially crafted network message. The vulnerability exists in how the node processes requests about blockchain data when reaching the earliest block (genesis block), causing an unhandled panic that terminates the node. This is a network-level denial-of-service that requires no authentication and can be exploited by any peer on the Nimiq network.

• CVE-2026-46544MEDIUM 5.3

  Microsoft's UFO framework for intelligent automation has a session reuse vulnerability affecting version 3.0.1-4-ge2626659. When a client completes a task, the session remains in memory with its results. An authenticated attacker who knows a past session ID can submit a new task request reusing that ID, causing the server to return stale results from the previous session to the new requester. This is not a critical vulnerability but poses a confidentiality risk—the attacker must be authenticated and must guess or know a valid session ID, limiting real-world exploitability.

• CVE-2026-46611MEDIUM 5.3

  Glances, a popular open-source system monitoring tool, contains a vulnerability in its XML-RPC server (activated with the -s flag) that fails to validate the HTTP Host header. This omission enables DNS rebinding attacks, where an attacker tricks a user's browser into connecting to the Glances server and extracting sensitive system monitoring data—CPU usage, memory, disk space, network statistics, running processes—without the user's knowledge. The attack requires user interaction (typically visiting a malicious website) but can expose comprehensive system information. The vulnerability affects all versions prior to 4.5.5 and is resolved in that release.

• CVE-2026-46698MEDIUM 5.3

  The Fediverse Embeds WordPress plugin before version 1.5.9 contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker can exploit a security flaw in which a nonce (one-time token) intended to protect an AJAX action is publicly exposed on every page with a fediverse embed. Because the nonce is reusable and appears in public page source, an attacker can hijack it to force the WordPress server to fetch arbitrary URLs via the plugin's file_get_html() function, potentially allowing reconnaissance of internal systems or interaction with internal services.

• CVE-2026-46705MEDIUM 5.3

  Russh, a popular Rust-based SSH library used by developers to build SSH servers, has a flaw in how it manages authentication state. When a client sends multiple authentication requests (which is allowed by the SSH protocol), the library fails to properly reset internal tracking information when the username or service name changes. This means authentication decisions—like which login methods remain available or whether partial success has been achieved—can leak from one user's authentication attempt to another's. An attacker could exploit this to bypass intended authentication restrictions or gain unauthorized access to accounts.

• CVE-2026-46739MEDIUM 5.3

  Net::Statsd is a Perl library used to send metrics to statsd monitoring servers. Versions before 0.13 fail to validate metric names and values, allowing an attacker to inject arbitrary statsd commands by crafting malicious metric input. If an application uses Net::Statsd to process untrusted data—such as user-supplied values or data from external APIs—an attacker can inject additional metrics into the monitoring stream, potentially corrupting metrics, creating false alerts, or degrading visibility into system health.

• CVE-2026-46790MEDIUM 5.3

  Oracle WebCenter Content version 14.1.2.0.0 contains an information disclosure vulnerability that allows an unauthenticated attacker to read sensitive data over the network without requiring credentials or user interaction. The vulnerability is exposed through HTTP and rated medium severity due to its limited scope—only confidentiality is affected, with no impact to data integrity or system availability.

• CVE-2026-46830MEDIUM 5.3

  Oracle REST Data Services contains an information disclosure vulnerability in its Mongoapi component that allows an unauthenticated attacker to read sensitive data over the network without authentication. An attacker with network access can exploit this flaw via HTTPS to gain unauthorized visibility into data normally protected by REST Data Services, though they cannot modify or delete information. The vulnerability affects versions 24.2.0 through 26.1.0 and requires no special conditions—it's straightforward to trigger.

• CVE-2026-46841MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a network-accessible vulnerability that allows unauthenticated attackers to read sensitive data. An attacker on the network can reach the service over HTTPS without credentials and gain unauthorized access to a subset of the data REST Data Services manages. This is not a critical vulnerability—it does not enable system takeover, data modification, or service disruption—but it does represent a meaningful confidentiality risk for organizations relying on REST Data Services for data access control.

• CVE-2026-46842MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a vulnerability that allows an unauthenticated attacker to modify, add, or delete data accessible through the service over the network. The vulnerability requires no special conditions to exploit and can be triggered via standard HTTPS connections. While an attacker cannot read data or crash the service, they can alter stored information, which poses a direct integrity risk to applications relying on ORDS for data access.

• CVE-2026-46843MEDIUM 5.3

  Oracle REST Data Services versions 24.2.0 through 26.1.0 contain a vulnerability that allows an attacker without credentials to trigger a partial denial of service over the network via HTTPS. The vulnerability is in the Core component and requires no special user interaction. An attacker can exploit this remotely to degrade availability of the REST Data Services instance, though data confidentiality and integrity are not at risk.

• CVE-2026-47167MEDIUM 5.3

  Vim, a widely-used command-line text editor, contains a code injection flaw in its Cucumber filetype plugin when Ruby support is enabled. The vulnerability arises from unsafe handling of step-definition patterns extracted from Ruby files in a repository's features or stories directories. When a user attempts to jump to a step definition using Vim's step-jump mapping, malicious patterns can execute arbitrary Ruby code and shell commands. This requires local access and user interaction—the attacker must first get the user to open a repository containing a crafted .rb file, then the user must trigger the vulnerable mapping. The issue is resolved in Vim version 9.2.0496.

• CVE-2026-47200MEDIUM 5.3

  Nuxt, a popular Vue.js web development framework, has a vulnerability where certain server-side page components are exposed over HTTP without proper security checks when a feature called Component Islands is enabled. This exposure allows unauthorized access to sensitive functionality that should only be available to authenticated users or through protected routes. The vulnerability affects Nuxt versions 3.11.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the related @nuxt/nitro-server package in the same version ranges.

• CVE-2026-47244MEDIUM 5.3

  Netty, a widely-used framework for building network applications and HTTP/2 servers, has a flaw in how it manages concurrent HTTP/2 streams. By default, Netty does not enforce a limit on the number of concurrent streams a client can open on a single connection, allowing an attacker to exhaust server resources by opening hundreds of thousands of stream objects. This vulnerability becomes especially dangerous when combined with Rapid-Reset-style attacks, where attackers can amplify their impact by rapidly opening and closing many streams.

• CVE-2026-47264MEDIUM 5.3

  Discourse, a popular open-source discussion platform, contains an information disclosure vulnerability that exposes the names of restricted tag groups to unauthorized users. When the site setting 'tags_listed_by_group' is enabled, anonymous and unprivileged users can access an endpoint that reveals tag group names—including those meant to be invisible or restricted to specific user groups. This occurs because the system failed to filter sensitive metadata based on the requesting user's actual permissions. The vulnerability affects multiple version branches and has been patched across all active release tracks.

• CVE-2026-47674MEDIUM 5.3

  Hono's IP-restriction middleware, a security component designed to enforce access control by allowing or denying traffic based on IP address rules, contains a flaw in how it compares incoming IP addresses against configured rules. The vulnerability exists because the middleware only performs partial normalization of IPv6 addresses before comparing them to stored rules. When an attacker sends a request using an alternative representation of an IPv6 address—such as compressed notation, explicit-zero forms, or IPv4-mapped hex notation—the middleware fails to recognize it as matching a rule, silently skipping the check. This allows traffic that should be blocked to pass through, or blocks traffic that should be allowed, depending on rule configuration. The flaw affects Hono versions prior to 4.12.21.

• CVE-2026-47676MEDIUM 5.3

  Hono, a JavaScript web framework, contains a path handling vulnerability in versions before 4.12.21 that affects how mounted sub-applications receive requests. When URLs contain percent-encoded characters (like %C3%A9 for é), the framework strips the mount prefix incorrectly, causing the sub-application to see a mangled path. This can lead to requests being routed to unintended endpoints or exposing sensitive information through path confusion.

• CVE-2026-47706MEDIUM 5.3

  Strawberry GraphQL versions 0.71.0 through 0.315.6 contain a denial-of-service vulnerability in the QueryDepthLimiter extension. An attacker can craft a GraphQL query with circular fragment references that causes the validation process to enter infinite recursion, crashing the server. This affects any GraphQL API built with vulnerable Strawberry versions. The issue is resolved in version 0.315.7.

• CVE-2026-47707MEDIUM 5.3

  Strawberry GraphQL, a Python library for building GraphQL APIs, contains a flaw in its MaxAliasesLimiter security extension that allows attackers to bypass protective limits on query aliases. The vulnerability exists because the extension counts static aliases correctly but fails to account for how fragment spreads multiply and amplify those aliases during execution. An attacker can craft a malicious GraphQL query using fragment spreads to force the server to resolve far more aliases than the configured limit permits, exhausting server resources and causing a denial of service. The issue affects versions 0.172.0 through 0.315.6; version 0.315.7 and later contain the fix.

• CVE-2026-47847MEDIUM 5.3

  Bitnami's MariaDB Galera container images and Helm chart ship with a hardcoded, publicly known username and password (monitor/monitor) that allows replication health checks. This credential cannot be changed during standard deployments and grants database replication privileges from any network location. An attacker who discovers a vulnerable Galera cluster can use this credential to access replication functions, potentially to monitor or interfere with database replication status.

• CVE-2026-48043MEDIUM 5.3

  Netty's HTTP/2 decompression logic has a resource leak that can exhaust memory and crash the JVM. When a remote attacker sends specially crafted HTTP/2 frames, the decompressor fails to properly release memory buffers, and repeated exploitation can lead to out-of-memory errors. This affects Netty versions before 4.1.135.Final and 4.2.15.Final.

• CVE-2026-48108MEDIUM 5.3

  Russh, a Rust-based SSH library, has a vulnerability in how it validates the initial identification string that clients and servers exchange during SSH connection setup. From version 0.34.0-beta.1 through 0.60.x, the library's server-side parser accepts malformed pre-banner lines that stricter SSH implementations like OpenSSH would reject immediately. An attacker can exploit this by sending invalid identification data repeatedly, causing the server to consume connection resources during the unencrypted pre-authentication phase. This is fixed in version 0.61.0.

• CVE-2026-48141MEDIUM 5.3

  A memory leak exists in National Instruments' grpc-device BeginSidebandStream function that can be exploited to exhaust server memory and cause denial of service. An authenticated attacker can trigger this leak repeatedly, eventually forcing the affected service to crash or become unresponsive. The vulnerability affects NI grpc-device version 2.17.0 and earlier.

• CVE-2026-48166MEDIUM 5.3

  Filament, a popular Laravel development framework, contains a timing-based information disclosure vulnerability in its login page. An unauthenticated attacker can exploit a measurable delay difference in login responses to determine whether a given email address is registered in the system. The flaw affects versions 4.0.0 through 4.11.4 and 5.0.0 through 5.6.4. While the exposure is limited to account enumeration—confirming email existence without gaining unauthorized access—this reconnaissance capability can support targeted phishing, account takeover attempts, or social engineering campaigns. The vulnerability has been patched in versions 4.11.5 and 5.6.5.

• CVE-2026-48206MEDIUM 5.3

  Apache Camel's JIRA integration allows unauthenticated attackers to manipulate JIRA operations by injecting HTTP headers. When a Camel route bridges incoming HTTP requests to a JIRA producer, attackers can inject headers that override the route's intended parameters—such as which issue to modify, which project to target, or what transition to apply—using the service account credentials configured in the endpoint. The vulnerability stems from Camel's header filtering logic, which was designed to block internal Camel-namespaced headers but inadvertently allowed plain header names (like 'IssueKey' and 'ProjectKey') to pass through from HTTP clients. This means an attacker can perform JIRA operations—deleting issues, changing their status, creating issues in unintended projects, modifying fields, managing watchers, or logging time—limited only by what the service account is permitted to do.

• CVE-2026-48525MEDIUM 5.3

  PyJWT, a widely-used Python library for JSON Web Token (JWT) handling, contains a denial-of-service vulnerability in its handling of detached JWS (JSON Web Signature) tokens. When processing tokens with the unencoded-payload option enabled (RFC 7797's b64=false mode), the library decodes the Base64URL-encoded payload segment before applying detached-payload verification rules. An attacker can exploit this by sending a specially crafted token with an extremely large payload segment, forcing the library to perform unnecessary decoding and memory allocation even before signature validation occurs. This creates a resource exhaustion attack that can be triggered by unauthenticated remote clients against any application using PyJWT to verify detached JWS tokens.

• CVE-2026-48817MEDIUM 5.3

  Starlette versions 1.0.1 and earlier have a flaw in how they route HTTP requests to handler methods. When an endpoint class is set up without explicitly listing allowed HTTP methods, the framework will accept any HTTP verb and attempt to call it as a method on the endpoint object. An attacker can exploit this by sending requests with crafted HTTP methods that match internal helper methods on the endpoint, bypassing authorization checks that would normally protect those methods. FastAPI applications built on vulnerable Starlette versions are also affected. This issue is fixed in Starlette 1.1.0.

• CVE-2026-48840MEDIUM 5.3

  Exim versions 4.88 through 4.99.3 contain a memory disclosure vulnerability when deployed in certain proxy configurations. The flaw allows unauthenticated remote attackers to craft short payloads that cause the mail server to leak uninitialized stack memory back to the client. This is a confidentiality issue—an attacker gains access to sensitive data that may be in memory, but cannot modify email systems or cause service disruption directly.

• CVE-2026-48859MEDIUM 5.3

  A timing side-channel vulnerability in Erlang/OTP's SSH implementation allows attackers to discover valid usernames on an SSH server without authentication. When certain password authentication methods are enabled, the SSH daemon takes noticeably longer (~300ms) to reject logins for real usernames than for fake ones (~0ms). An attacker can exploit this timing difference to enumerate valid user accounts by measuring response times across many login attempts. The vulnerability only affects SSH servers using the legacy user_passwords or password configuration options, which are documented as test-only features; production deployments using the recommended pwdfun alternative are unaffected.

• CVE-2026-48937MEDIUM 5.3

  Node.js HTTP/2 servers have a flaw where they continue processing incoming data even after sending a GOAWAY frame—a signal that should cleanly terminate the connection. This causes servers to accept and process requests they should have already rejected, potentially leading to resource exhaustion. Node.js 22 and 24 are affected. The vulnerability is not currently known to be exploited in the wild.

• CVE-2026-48945MEDIUM 5.3

  K2, a popular article management component for Joomla, contains a vulnerability in its gallery upload feature. When users upload ZIP or TAR archives containing images, the system extracts them to a web-accessible directory but only safely renames actual image files (GIF, JPG, JPEG, PNG, WebP). Non-image files—critically, PHP scripts—are extracted with their original names and remain executable. An attacker can upload an archive containing a PHP webshell alongside legitimate images, and then directly access the shell via HTTP to execute arbitrary code on the server.

• CVE-2026-48988MEDIUM 5.3

  markdown-it, a widely-used Markdown parser, contains a denial-of-service vulnerability in versions 14.1.1 and earlier when the typographer feature is enabled. When processing Markdown text with many quotation marks, the parser consumes excessive CPU due to inefficient string manipulation, potentially allowing an attacker to degrade service availability by submitting specially-crafted Markdown. The vulnerability is fixed in version 14.2.0. Although the typographer feature is off by default, many production applications enable it for enhanced typography, making this issue relevant to deployed systems.

• CVE-2026-48990MEDIUM 5.3

  joserfc, a Python library for handling JSON Web Signatures and Encryption, has a flaw in how it processes unencoded JWS payloads (a feature defined in RFC7797). The library correctly enforces maximum payload size limits for standard JWS formats, but bypasses those same limits when processing JWS tokens marked with b64=false, which signals unencoded payloads. An attacker can exploit this inconsistency by sending an oversized JWS token that passes validation despite exceeding configured size restrictions, potentially exhausting server memory and causing denial of service. The vulnerability affects versions 1.3.4 through 1.6.5 and is resolved in version 1.6.7.

• CVE-2026-48998MEDIUM 5.3

  A library used by PHP developers to handle HTTP messages (guzzlehttp/psr7) has a flaw in how it validates the Host header when processing HTTP requests. An attacker can craft a malicious Host header that tricks the library into misidentifying which server the request is intended for. For example, an attacker could use a Host header like `[email protected]` which the library might interpret as being meant for `evil.example` rather than `trusted.example`. This matters most if your application relies on the Host header to decide where to route requests or whether to trust them. In worst-case scenarios—particularly for API gateways, proxies, or request forwarding services—this could lead to sensitive requests or credentials being sent to an attacker's server instead of the intended destination.

• CVE-2026-49077MEDIUM 5.3

  WP eMember, a WordPress membership plugin by Tips and Tricks HQ, contains a vulnerability that exposes sensitive system information to unauthorized users. An attacker without authentication can retrieve embedded sensitive data through network access, potentially learning details about your WordPress installation and membership infrastructure that should remain private. The vulnerability affects all versions through v10.2.2.

• CVE-2026-49098MEDIUM 5.3

  Apache Camel's Kafka component contains a header-injection vulnerability that allows untrusted HTTP clients to redirect Kafka messages to unintended topics. When an HTTP consumer (like platform-http) is chained into a Kafka producer within the same Camel route, attackers can inject kafka.* headers through HTTP requests to override the configured target topic, alter timestamps, or target specific partitions. This is possible because the HTTP header filter only blocks Camel-prefixed headers, allowing kafka.* headers to pass through and reach the Kafka producer unfiltered. No authentication is required if the HTTP endpoint is publicly accessible.

• CVE-2026-49099MEDIUM 5.3

  Apache Camel's Salesforce component has a vulnerability that allows attackers to hijack database queries and operations by injecting malicious headers through HTTP requests. When a route connects an HTTP endpoint to Salesforce, an unauthenticated attacker can override the intended SOQL queries, target objects, or API calls by setting specific HTTP headers. These operations execute with full permissions of the Salesforce integration user, potentially exposing sensitive data or performing unauthorized modifications. The issue stems from Camel's HTTP header filtering not recognizing Salesforce control headers as privileged, allowing them to pass through from untrusted external sources.

• CVE-2026-49130MEDIUM 5.3

  Music Player Daemon (MPD) versions before 0.24.11 have a flaw that allows attackers to inject hidden line breaks and special characters into playlist files. By crafting a malicious XSPF playlist file (a common music playlist format), an attacker can trick MPD into including forged commands or data in its responses, potentially deceiving clients or users who rely on MPD's output. This is a network-based attack requiring no special permissions or user interaction, though the real-world impact depends on how downstream systems handle the injected content.

• CVE-2026-49214MEDIUM 5.3

  guzzlehttp/psr7 versions before 2.10.2 fail to sanitize special characters in user-supplied URLs, allowing attackers to inject additional HTTP headers into outbound requests. If your application constructs HTTP requests from untrusted URLs—such as user input, forwarded requests, or webhook destinations—an attacker can craft a malicious URL that breaks out of the host parameter and injects fake headers like `X-Injected: yes`. This becomes especially dangerous when requests are relayed through proxies or load balancers, where the malformed headers can poison caches or trigger request smuggling attacks.

• CVE-2026-49328MEDIUM 5.3

  A Server-Side Request Forgery (SSRF) vulnerability exists in Apache Fesod's image URL handling component. When an application built on Fesod processes user-supplied image URLs, an attacker can craft malicious URLs that cause the server to make unexpected outbound requests to internal systems, private cloud metadata services, or other network-restricted resources. This allows attackers to probe or interact with infrastructure that should not be directly accessible from the internet.

• CVE-2026-49342MEDIUM 5.3

  YARD, a popular documentation generator for Ruby, contains a path traversal vulnerability that allows attackers to read HTML files outside the intended documentation directory. The flaw occurs because the application checks its static file cache before properly cleaning up request paths, enabling specially crafted URLs to escape the configured document root and access sibling files. This affects versions prior to 0.9.44 and is fixed in that release.

• CVE-2026-49365MEDIUM 5.3

  Apache Camel's Netty HTTP component has a flaw where error messages are returned to users in plain text, potentially exposing sensitive information like stack traces, credentials, and internal system details. The problem stems from a default setting (muteException=false) that differs from other Camel HTTP components. Any unauthenticated user who can reach the endpoint and trigger an error—such as sending a malformed request—receives the full Java stack trace, which can reveal internal architecture and aid attackers in planning further compromises.

• CVE-2026-49397MEDIUM 5.3

  Nezha Monitoring, a self-hosted server and website monitoring tool, has a flaw in versions 2.0.0 through 2.0.13 that allows attackers to discover private services that administrators intended to keep hidden. Specifically, services marked as private (with EnableShowInService set to false) can still be enumerated through per-server API endpoints, exposing their names and response timing information. An attacker with network access to a Nezha instance doesn't need credentials to exploit this—they can systematically query endpoints and infer which services exist and how they behave based on timing patterns. This undermines the intended privacy controls.